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REMARKS 



The Examiner has rejected Claims 1-3, 5-12, 14-21, 23-30, 32-39, 41-48 and 50- 
54 under 35 U.S.C. 103(a) as being unpatentable over Lahti et al. (U.S. Patent 
Application No. 2002/0042886) in view of Hansson (WO 98/38820). Applicant 
respectfully disagrees with such rejection. 

With respect to each of the independent claims, the Examiner has relied on 
paragraphs [0019] and [0023] in Lahti along with page 6, lines 1-5 in Hansson to make a 
prior art showing of applicant's claimed technique "wherein said mobile data processing 
device registers with a base station of said wireless telephony network when said link is 
established such that said base station and said wireless telephony network are notified of 
a telephone number of said mobile data processing device for use in sending said 
malware definition updating data to said mobile data processing device." 

First, applicant respectfully asserts that neither Lahti nor Hansson disclose a 
"mobile data processing device [that] registers with a base station of said wireless 
telephony network when said link is established," as claimed by applicant (emphasis 
added). In particular, Lahti only generally teaches that "a record of all subscribers to the 
anti-virus server [is maintained] in a database" (paragraph [0023]), but not that a "mobile 
data processing device registers with a base station. . .when said link is established," as 
applicant claims. In addition, the entire Hansson reference, and in particular the excerpt 
in Hansson relied on by the Examiner, fails to even suggest any sort of registration , and 
especially not in the specific manner claimed by applicant. 

Second, applicant notes that the Examiner has relied on Hansson's disclosure of 
an "update server processor 100 [that] downloads the software by placing a call to the 
cellular phone and performing. . . [a] data transfer to the cellular telephone 1 1 0." 
Applicant respectfully asserts that simply utilizing a phone number to transfer a 
download does not meet applicant's specific claim language, namely that a "mobile data 
processing device registers with a base station of said wireless telephony network when 
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said link is established such that said base station and said wireless telephony network are 
notified of a telephone number of said mobile data processing device for use in sending 
said malware definition updating data to said mobile data processing device" (emphasis 
added), in the context claimed. 

In fact, applicant emphasizes that Hansson actually teaches away from registering 
such that notification of a telephone number is made, in the maimer claimed by applicant, 
since Hansson discloses that " [i]n response to the cellular telephone subscriber's 
acceptance of the update , the cellular telephone 1 10 transmits a SMS message to the 
update server processor 1 00, wherein the message contains an acceptance code and the 
telephone number of the cellular telephone 110" (see page 5, lines 15-18-emphasis 
added). 

In the Advisory mailed 04/1 1/2006, the Examiner, in response, argued that 
"[a]pplicant concedes that Lahti teaches a register that contains record of all the 
subscribers to the anti-virus service, therefore it is inherent or obvious to one of ordinary 
skill in the art that there is teaching and/or suggestion of registration of the subscribers in 
order for the center to have the records of the subscribers that subscribe to the service." 
Applicant respectfully disagrees with the Examiner's inherency/obviousness argument. 
Whether or not the above statement by the Examiner is correct or not, the Examiner has 
still not taken into consideration the full weight of applicant's claims. Specifically, Lahti 
only suggests " registered subscribers" (emphasis added). Merely maintaining a record of 
registered subscribers simply does not meet a technique "wherein said mobile data 
processing device registers with a base station of said wireless telephony network when 
said link is established ..." (emphasis added), as claimed by applicant. 

Still with respect to each of the independent claims, the Examiner has relied on 
paragraphs [0022]-[0027] in Lahti to make a prior art showing of applicant's claimed 
technique "wherein said malware definition updating data is provided in a malware 
definition updating file, where said file is generated by one of automatically, semi- 
automatically, and manually upon an analysis of newly discovered malware and where 
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said file includes a detection fingerprint, and at least one of a removal action and a 
disinfection action to be taken in response to a detection of said newly discovered 
malware." 

Applicant respectfully asserts that such excerpt from Lahti only discloses an 
"SMS request,.. containing signatures for viruses discovered and analysed since the 
previous update... which causes the new signature(s) to be incorporated into the anti-virus 
database for future use." Thus, Lahti teaches that the message only contains the updated 
virus signatures, and not that the "file includes... at least one of a removal action and a 
disinfection action to be taken in response to a detection of said newly discovered 
malware," as claimed by applicant. To further emphasize such distinction, applicant 
points out paragraph [0027] in Lahti which states that "the user is warned 30 and given 
the opportunity to delete or clean that file." Clearly, a user that must decide whether to 
delete or clean a file does not suggest that a malware definition updating file " includes at 
least one of a removal action and a disinfection action to be taken in response to a 
detection of said newly discovered malware" (emphasis added), as applicant claims. 

In the Advisory mailed 04/1 1/2006, the Examiner, in response, argued that "[i]n 
response to Applicant's argument that Lahti only discloses messages that contain updates 
and not files, Examiner asserts that Lahti discloses and suggests several ways of 
obtaining updates..." However, applicant respectfully asserts that the cited excerpts from 
Lahti fail to even suggest a technique "... where said file includes a detection fingerprint, 
and at least one of a removal action and a disinfection action to be taken in response to a 
detection of said newly discovered malware " (emphasis added), as claimed. Lahti 's 
teaching that "the user is warned 30 and given the opportunity to delete or clean that file" 
in no way even suggests that the "definition updating file" includes "at least one of a 
removal action and a disinfection action " (emphasis added), as claimed by applicant. 
Only applicant teaches and claims an updating file including such specifically claimed 
action(s). 
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Furthermore, with respect to each of the independent claims, the Examiner has 
failed to specifically address applicant's claimed technique "wherein said mobile data 
processing device is identified by a database of subscribers to an update service 
associated with said malware scanner, where said database includes said telephone 
number of said mobile data processing device to which said malware definifion updating 
data is to be sent and a type of said mobile data processing device such that only malware 
definition updating data that is appropriate to said type of said mobile data processing 
device is sent to said mobile data processing device" (emphasis added). 

Applicant notes, however, that in Lahti "an SMS message [is sent] to the server 
1 2 from a device 1 . . .containing details of which virus signatures are currently stored in 
the device's signature database" such that "the anti-virus server 12 needs only to issue an 
SMS request. . .containing virus signatures not currently on the signature database of the 
mobile device 1." Thus, Lahti only teaches determining appropriate updated signatures 
based on signatures already located on the device , and not that a "database includes a 
type of said mobile data processing device such that only malware definition updating 
data that is appropriate to said type of said mobile data processing device is sent to said 
mobile data processing device," as applicant claims (emphasis added). 

In the Advisory mailed 04/1 1/2006, the Examiner, in response, argued "[i]n 
response to Applicant's argument that Lahti does not disclose a database that includes a 
type of mobile device, this limitation is already addressed by Examiner as cited in 
paragraphs 23-26, the server generates a corresponding update upon request from the 
subscriber." However, Lahfi's disclosure that "[u]pon receipt of a request, the SMS 
centre 5 generates a corresponding SMS message and send this to the destination mobile 
device. . ." simply fails to meet a technique "where said database includes said telephone 
number of said mobile data processing device to which said malware definition updating 
data is to be sent and a type of said mobile data processing device such that only 
malware definition updating data that is appropriate to said type of said mobile data 
processing device is sent to said mobile data processing device" (emphasis added), as 
claimed by applicant. There simply is no disclosure in the excerpts from Lahti relied 
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upon by the Examiner for a technique where "only malware definition updating data that 
is appropriate to said type of said mobile data processing device is sent to said mobile 
data processing device" (emphasis added), as claimed by applicant. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.l991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest aU of the claim limitations, as noted above. Thus, all of the 
independent claims are deemed allowable. Moreover, the remaining dependent claims 
are further deemed allowable, in view of their dependence on such independent claims. 



